Published on DigitalSpying.com | October 5, 2026
Author: DigitalSpying Threat Research Team
Threat Classification: Web Application Security | Cryptographic PRNG Breakdown | Active In-The-Wild RCE
|---|
Executive Summary
Generating session keys and cryptographic tokens requires true randomness. When developers substitute cryptographically secure random number generators with non-cryptographic convenience functions, the resulting illusion of security can unravel in seconds. On October 5, 2026, The Hacker News and vulnerability intelligence firm VulnCheck reported active in-the-wild exploitation of CVE-2026-61500—a critical vulnerability carrying a CVSS v3.1 score of 9.3 impacting Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0.
Discovered and reversed by security researcher Alejandro Ramos (aramosf) with accompanying technical depth from Horizon3.ai, the vulnerability allows unauthenticated attackers to harvest output from the Node.js V8 pseudo-random number generator (Math.random()) during unauthenticated login handshakes. By mathematically reconstructing the generator’s internal state, attackers recover the server’s master session-signing secret, forge administrative session cookies, and leverage HFS’s built-in server_code execution feature to achieve unauthenticated Remote Code Execution (RCE) on the host operating system.
Technical Deep-Dive: From Flawed PRNG to Administrative Takeover
1. The Modern Rejetto HFS Architecture
While legacy versions of Rejetto HFS (version 2.x) were compiled in Delphi, modern HFS 3.x is a complete rewrite built on Node.js and the Koa web framework, designed to offer high-performance web file sharing and RESTful administration:
* Authentication Handshake: The server implements Secure Remote Password (SRP) protocol flows for user and administrator authentication.
* Session Integrity: User sessions are maintained via signed HTTP cookies signed with a master secret key initialized when the server process starts up.
2. The Cryptographic Flaw: Non-Cryptographic PRNG in V8
The fundamental breakdown lies in the derivation of the Koa session-signing secret:
* Insecure Key Generation: At startup, the application derived its master cookie-signing secret by calling JavaScript's built-in Math.random() function rather than the cryptographically secure crypto.randomBytes().
* The Information Leak: During the unauthenticated SRP authentication handshake, the server generates challenge parameters and nonces utilizing the exact same global V8 Math.random() generator, transmitting those raw pseudo-random outputs directly to unauthenticated web clients.
[Unauthenticated Attacker]
│
│ 1. Sends ~5 Unauthenticated SRP Login Handshakes
▼
[Rejetto HFS 3.x (Node.js / Koa)]
│
│ 2. Discloses Raw Math.random() Outputs in Nonce Responses
▼
[Attacker Mathematical Analysis (Xoroshiro128+ Solver)]
│
│ 3. Reconstructs Internal V8 PRNG State
│ 4. Recovers Master Session-Cookie Signing Secret
▼
[Administrative Session Cookie Minted (hfs_session)]
│
│ 5. Dispatches HTTP POST to Admin /api/config with server_code
▼
[Host Operating System Shell Execution]
└── Executes arbitrary server-side JavaScript / drops reverse shell
3. Exploitation Mechanics: Reconstructing Xoroshiro128+
In the V8 JavaScript engine (used by Node.js), Math.random() is powered by the Xoroshiro128+ algorithm:
1. State Recovery: Xoroshiro128+ maintains a 128-bit internal state split into two 64-bit unsigned integers (s0 and s1). The algorithm is fast, but it is explicitly non-cryptographic. By observing two to three consecutive 64-bit floating-point outputs, an attacker can solve the linear congruential equations using Z3 constraint solvers or custom algebraic algorithms.
2. Key Recovery: Once the PRNG state is synchronized, the attacker rewinds or projects the generator to deduce the exact random bytes that were generated at server startup to sign Koa session cookies.
3. Session Cookie Forgery: With the signing secret recovered, the attacker crafts a valid serialized JSON cookie representing an active admin session and signs it using the reconstructed key.
4. Execution via server_code: HFS includes a legitimate administrative feature named server_code, intended to allow administrators to customize server behaviors with custom JavaScript snippets. The attacker presents their forged administrator cookie, invokes the configuration API to enable server_code, and executes arbitrary Node.js commands (such as spawning /bin/sh or downloading malware stagers).
Threat Landscape & In-The-Wild Exploitation
Threat telemetry from VulnCheck confirmed active exploitation starting October 1, 2026, with automated attack bots scanning IPv4 address spaces for exposed HFS instances:
* The Beachhead Target: Rejetto HTTP File Server has historically been a prime target for automated exploitation. In 2024, attackers broadly weaponized CVE-2024-23692 to deploy the HATVIBE trojan and Monero cryptocurrency miners.
* Immediate Weaponization: Because public Python-based exploit scripts are actively circulating, unpatched servers exposed to the public internet face immediate administrative compromise and botnet recruitment.
Mitigation & Hardening Blueprint
Administrators managing Rejetto HFS deployments must take immediate defensive action:
1. Update to Rejetto HFS 3.2.1+
Upgrade to the latest release of Rejetto HFS, which replaces Math.random() with crypto.randomBytes() for all session token generation and cryptographic handshakes.
2. Sever Public Internet Exposure
* Do Not Expose Management Consoles Publicly: File-sharing servers should be placed behind corporate VPNs, Cloudflare Access tunnels, or reverse proxies with multi-factor authentication (MFA).
* If public file downloads are required, enforce strict network segregation between public download directories and administrative API endpoints.
3. Triage and Forensic Inspection
If an unpatched instance was exposed during early October 2026:
* Check server configuration files (specifically config.yaml or internal SQLite databases) for unauthorized additions to the server_code directive.
* Inspect the underlying server process table for unexpected child processes spawned by Node.js (e.g., cmd.exe, powershell.exe, /bin/sh, or unauthorized outbound curl connections).
4. Software Development Hygiene: Ban Math.random() in Security Paths
For software engineering teams, this vulnerability serves as a stark reminder:
* Static analysis security testing (SAST) linters (such as ESLint with eslint-plugin-security) must enforce rules prohibiting Math.random() in any context touching sessions, tokens, passwords, salts, or cryptography.
* Always use crypto.randomBytes(32) or crypto.getRandomValues() in Node.js and browser runtimes.
References & Threat Intelligence
* The Hacker News: Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
* VulnCheck Vulnerability Intelligence Advisory
* Horizon3.ai Research Breakdown